Virtual smart card to perform security-critical operations

• US 9,009,817 B1
• Filed: 03/12/2013
• Issued: 04/14/2015
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: Open Invention Network LLC
• Original Assignee: Open Invention Network LLC
• Inventors: Wieland, Martin
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US13/796,834
• Time in Patent Office: 763 Days
• Field of Search: None
• US Class Current: 726/19
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

A portable data or information carrier in the form of a smart card with partially or fully virtualized components. To maximize the confidentiality of information stored in the carrier, and more specifically to limit the amount of information available to a potential defrauder, electronic components such as circuits, I/O, cryptographic, memory and dummy objects are built, modified or influenced on demand from physical characteristics of an eligible person or device. Digitized unique biometric or hardware identifiers are read upon start-up and runtime of the device and, in case of an eligible person or device, subsequently supply all values necessary for determination of the characteristics of the user specific virtual smart cards objects, their placement and connections. By multi-factor authentication, the end-user or device will retain sole control of its keys and use them for authentication, signature or encryption purposes as if he had a physical smart card in his hand.

Claims

1. A method of enabling a virtual smart card, the method comprising:

prompting the user for a unique identifier;

receiving the unique identifier based on user input;

initializing the virtual smart card in response to the received unique identifier;

reading data associated with the unique identifier via a reader device, wherein the data comprises a key stream of digital data bits associated with the unique identifier;

identifying a user'"'"'s smart card base address from a first portion of the digital data bits of the key stream; and

authenticating a user based on received unique identifier and results of the read data.

2. The method of claim 1, wherein the unique identifier comprises digital biometric data.

3. The method of claim 2, wherein the digital biometric data is part of the key stream and is associated with a digitized fingerprint.

4. The method of claim 3, wherein the reader device uses its own clock cycles to compute a defined part of the key stream of the digitized fingerprint.

5. The method of claim 4, wherein subsequent portion of bits of the key stream are offsets of corresponding objects.

6. The method of claim 1, further comprising:

loading a secret 48-bit key into a shift register; and

shifting a string into a state that the received unique identifier matches an identifier of a corresponding tag.

7. The method of claim 6, further comprising:

generating a random number; and

sending the random number to the reader device and proving that the tag and reader have knowledge of the secret 48-bit key.

8. An apparatus configured to enable a virtual smart card, the apparatus comprising:

a transmitter configured to transmit a prompt to the user for a unique identifier;

a receiver configured to receive the unique identifier based on user input; and

a processor configured to

initialize the virtual smart card in response to the received unique identifier, read data associated with the unique identifier via a reader device, wherein the data comprises a key stream of digital data bits associated with the unique identifier;

identify a user'"'"'s smart card base address from a first portion of the digital data bits of the key stream; and

authenticate a user based on received unique identifier and results of the read data.

9. The apparatus of claim 8, wherein the unique identifier comprises digital biometric data.

10. The apparatus of claim 9, wherein the digital biometric data is part of the key stream and is associated with a digitized fingerprint.

11. The apparatus of claim 10, wherein the reader device uses its own clock cycles to compute a defined part of the key stream of the digitized fingerprint.

12. The apparatus of claim 11, wherein a subsequent portion of bits of the key stream are offsets of corresponding objects.

13. The apparatus of claim 8, wherein the processor is further configured to load a secret 48-bit key into a shift register, and shift a string into a state that the received unique identifier matches an identifier of a corresponding tag.

14. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to enable a virtual smart card, the processor being configured to perform:

prompting the user for a unique identifier;

receiving the unique identifier based on user input;

initializing the virtual smart card in response to the received unique identifier;

reading data associated with the unique identifier via a reader device, wherein the data comprises a key stream of digital data bits associated with the unique identifier;

identifying a user'"'"'s smart card base address from a portion of the digital data bits of the key stream; and

authenticating a user based on received unique identifier and results of the read data.

15. The non-transitory computer readable storage medium of claim 14, wherein the unique identifier comprises digital biometric data.

16. The non-transitory computer readable storage medium of claim 15, wherein the digital biometric data is part of the key stream and is associated with a digitized fingerprint.

17. The non-transitory computer readable storage medium of claim 16, wherein the reader device uses its own clock cycles to compute a defined part of the key stream of the digitized fingerprint.

18. The non-transitory computer readable storage medium of claim 17, wherein subsequent bits of the key stream are offsets of corresponding objects.

19. The non-transitory computer readable storage medium of claim 14, further comprising:

loading a secret 48-bit key into a shift register; and

shifting a string into a state that the received unique identifier matches an identifier of a corresponding tag.

20. The non-transitory computer readable storage medium of claim 19, further comprising:

generating a random number; and

sending the random number to the reader device and proving that the tag and reader have knowledge of the secret 48-bit key.